Overview

overview

10

Static

static

10

2964-130-0...ry.exe

windows7-x64

10

2964-130-0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2964-130-0x0000000000400000-0x0000000002579000-memory.dmp

  • Size

    33.5MB

  • MD5

    539c987724525a2e831942ab846b55b6

  • SHA1

    c44f1716943a9063b7451ce72b373643f75e14e8

  • SHA256

    5f4f2ae444770ca5a59c25d06c97ffc6e2b446018202d0261c5d76044c3f9ada

  • SHA512

    6694feec2521ddedac349cb72ae0baf78ce9f0af2c04ec34c1202cf89f581bb5f827a05bcfa324f28165c9b688094bfa713f62d66749414a4ea98deb248a2533

  • SSDEEP

    24576:70oujsW6ifTxUxv/3BObPdtjyT+nzUhb1NrcvXf5ySRRvse8rO52fi03ah1IMK4w:Aouj

Score
10/10
default100stealc

Malware Config

Extracted

Family

stealc

Botnet

default100

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2964-130-0x0000000000400000-0x0000000002579000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections